Converting some PHP Code into MySQLi Prepared Statements

[Mko]

Hey all,

I have the following code:

$db2 = new mysqli('localhost', 'root', '', 'vbulletin');
$db2->connect();

include_once("./vb_plugin.php");

$query = "UPDATE players SET mgroup = '{$vbulletin->GPC['user']['usergroupid']}', mgroup_others='{$vbulletin->GPC['user']['membergroupids']}', name='{$vbulletin->GPC['user']['username']}'";
if (!empty($vbulletin->GPC['password'])){
$salt = fetch_user_salt_new();
$hash = fetch_user_hash_new();
$query .= ", phash='{$hash}', psalt='" .$salt. "'";
}

$groups = "";
if (is_array($vbulletin->GPC['user']['membergroupids'])) {
  foreach ($vbulletin->GPC['user']['membergroupids'] AS $key => $val){
    $groups .= "{$val},";
  }
}

$query .= ", mgroup_others='{$groups}'";

$query .= " WHERE id = {$vbulletin->GPC['userid']}";

$db2->query($query);

$db2->close();

 

I'm wondering:

a) If anyone can help me with making this code's queries into prepared statements

b) If prepared statements can't be used, is this code vulnerable at all?

 

 

Thanks for any help,

Mark

[cpd]

We technically can't determine whether or not its safe as the $vbuletin object may have performed some sort of process on the data before using it in the query. However, taking your skill level into account I'd assume its not safe.

 

You need to firstly read up on PDO prepared statements and how to use them then relate it to your current code and implement it. Typically you'll prepare a statement using PDO::prepare($sql); then bind the parameters to the statement using PDOStatement::bindParam();. When you read up on PDO it'll make more sense.

 

 

[Mko]

We technically can't determine whether or not its safe as the $vbuletin object may have performed some sort of process on the data before using it in the query. However, taking your skill level into account I'd assume its not safe.

 

You need to firstly read up on PDO prepared statements and how to use them then relate it to your current code and implement it. Typically you'll prepare a statement using PDO::prepare($sql); then bind the parameters to the statement using PDOStatement::bindParam();. When you read up on PDO it'll make more sense.

What I really need to do is be able to append new query parts to the existing query at the beginning using Prepared Statements.

[cpd]

Within the select/where?

 

Just keep appending data to a string, then prepare the string, bind parameters and execute...